Search

International audience

Use error due to user interface design defects is a major concern in many safety critical domains, for example avionics and health care. Early detection of latent user interface problems can be facilitated by user-centered design methods that integrate formal verification technologies. This article considers the role that formal verification technologies can play in the context of user-centered design by considering the following three existing tools: CIRCUS, PVSio-web, and IVY. These tools have been developed to support the model based analysis of critical user interfaces. They have their foundations in existing formal verification technologies, but each of them is focused towards particular issues relating to user interface design. The article explores the different phases of the user-centered design process and the extent to which each of these tools supports these phases. Criteria are developed for assessing their role at each stage of the design process. The results of the evaluation provide guidance to developers to help choose the most appropriate tool based on their analysis needs while at the same time setting challenges for future developments, European Regional Development Fund through the Operational Programme for Competitiveness and Internationalisation and by National Funds through the Portuguese funding agency, FCT - Fundação para a Ciência e a Tecnologia (project POCI-01-0145-FEDER-016826)

International audience; Cyber-physical systems (CPS) integrate both physical and computational elements and their engineering requires bridging the continuous analog real world and the discrete digital world. User interfaces of cyber-physical systems belong to the class of command and control systems and their design and engineering usually follow ad-hoc craft processes highly parametrized by the very nature of the physical component(s). This paper proposes a systematic approach for engineering CPS, emphasizing the problems and possible solutions to design and assess their user interfaces (both control and presentation). The paper first proposes a generic architecture for CPS going from the physical element(s) to the user interface. This architecture is then refined, highlighting the behavior and software interfaces of each of its component and showing how information and control from the physical elements have to be processed and transformed to make sense to the operator. The paper presents extracts of the application of the proposed approach to the command and control cockpit application of an aircraft system.

International audience; Recommender Systems (RS) are nowadays widely used in the area of consumer electronics and home entertainment. They are exploited by large companies (such as Amazon in the area of e-commerce) and used by millions of users (e.g. 93 million for Netflix). With Recommender Systems, users explore possible items of interest, consult details about these items and read explanations about the choices offered, but these tasks are relevant to other application domains too. Recommender Systems can be a powerful option to support operators of critical systems who can be confronted with choosing the right option from a set of alternative (especially in the case of incidents). However, deploying recommender systems in critical contexts requires applying critical systems engineering practices throughout its development. As recommender systems are a special kind of interactive systems, those engineering practices must integrate and reconcile the ones of critical systems engineering and interactive systems engineering. This article presents a comprehensive study of the state of the art in recommender systems engineering which highlights the fact that their engineering is still in its infancy. In the light of Recommender Systems characteristics, we propose a systematic analysis of standards in critical systems engineering and knowledge from dependable computing field to extract a set of requirements that are relevant to Recommender Systems. As those requirements target at different components of a systems, we first propose a generic architecture to decompose Recommender Systems. This generic architecture integrates existing proposals from the Recommender Systems community with current knowledge in interactive systems architectures. In order to engineer Recommender Systems compliant with the entire list of requirements identified, we propose to use a set of complementary integrated model-based approaches from the literature. This approach is illustrated on a large case study about future aircraft alerting systems, which highlights the potential benefits of the usage of recommender systems in critical contexts.

This course takes a practical approach to introduce the principles, methods and tools in task modeling and how this technique can support identification of automation opportunities, dangers and limitations. A technical interactive hands-on exercise of how to "do it right", such as: How to go from task analysis to task models? How to identify tasks that are good candidate for automation (through analysis and simulation)? How to identify reliability and usability dangers added by automation? How to design usable automation at system, application and interaction levels? And more...

Arguments to support validity of most contributions in the field of human–computer interaction are based on detailed results of empirical studies involving cohorts of tested users confronted with a set of tasks performed on a prototype version of an interactive system. This chapter presents how the Interactive Cooperative Objects (ICO) formal models of the entire interactive system can support predictive and summative performance evaluation activities by exploiting the models. Predictive performance evaluation is supported by ICO formal models of interactive systems enriched with perceptive, cognitive, and motoric information about the users. Summative usability evaluation is addressed at the level of the software system, which is able to exhaustively log all the user actions performed on the interactive system The articulation of these two evaluation approaches is demonstrated on a case study from the avionics domain with a step-by-step tutorial on how to apply the approach.

National audience; This course takes a practical approach to introduce the principles, methods and tools in task modeling and how this technique can support identification of automation opportunities, dangers and limitations. A technical interactive hands-on exercise of how to "do it right", such as: How to go from task analysis to task models? How to identify tasks that are good candidate for automation (through analysis and simulation)? How to identify reliability and usability dangers added by automation? How to design usable automation at system, application and interaction levels? And more...

Ensuring that an interactive application allows users to perform their activities and reach their goals is critical to the overall usability of the interactive application. Indeed, the effectiveness factor of usability directly refers to this capability. Assessing effectiveness is a real challenge for usability testing as usability tests only cover a very limited number of tasks and activities. This paper proposes an approach towards automated testing of effectiveness of interactive applications. To this end we resort to two main elements: an exhaustive description of users’ activities and goals using task models, and the generation of scenarios (from the task models) to be tested over the application. However, the number of scenarios can be very high (beyond the computing capabilities of machines) and we might end up testing multiple similar scenarios. In order to overcome these problems, we propose strategies based on task models manipulations (e.g., manipulating task nodes, operator nodes, information ...) resulting in a more intelligent test case generation approach. For each strategy, we investigate its relevance (both in terms of test case generation and in terms of validity compared to the original task models) and we illustrate it with a small example. Finally, the proposed strategies are applied on a real-size case study demonstrating their relevance and validity to test interactive applications., Work at HASLab was carried out in the context of project "NORTE-01-0145-FEDER-000016", financed by the North Portugal Regional Operational Programme (NORTE 2020), under the PORTUGAL 2020 Partnership Agreement, and through the European Regional Development Fund (ERDF)., info:eu-repo/semantics/publishedVersion

International audience; In the academic area, recommender systems have received a lot of attention in the recent years (see for instance the increasing success of the RecSys conference). This success has also reached industry and the general public via large platforms such as Amazon or Netflix. The recommender systems present multiple benefits that can be attributed to automation by means of the migration of function from the operator to the Recommender System itself. Depending on the type of recommender system, these functions can cover: support to perception of information,support to identification of potentially relevant elements, support to the selection of one element amongst a list... Despite their widespread use, their development has not reached the level of maturity required for the deployment in the context of critical command and control systems. This position paper identifies some pre-requisite for making recommender systems deployable in critical context of critical systems.

International audience; Formal methods provide support for validation and verification of interactive systems by means of complete and unambiguous description of the envisioned system. Used in the early stages of the development process, they allow detecting and correcting development faults at design and development time. However, events that are beyond the envelope of the formal description may occur and trigger unexpected behaviours in the system at execution time (inconsistent from the formally specified system) resulting in failures. Sources of such interactive system failures can be permanent or transient hardware failures, due to, e.g. natural faults triggered by alpha particles from radioactive contaminants in the chips or neutrons from cosmic radiation. This chapter first presents a systematic identification of the faults that can be introduced in the system during both at development and operations time and how formal methods can be used in such context. To exemplify such usage of formal methods, we present their use to describe software architecture and self-checking components to address these faults in the context of interactive systems. As those faults are more likely to occur in the high atmosphere, the proposed solutions are illustrated using an interactive application within the field of interactive cockpits. This application allows us to demonstrate the use of the concepts and their application for WIMP interactive systems (such as the ones of the nuclear case study of the book).

International audience; During early phases of the development of an interactive system, future system properties are identified (through interaction with end-users, e.g., in the brainstorming and prototyping phases of the development process, or by requirements provided by other stakeholders) imposing requirements on the final system. Some of these properties rely on informal aspects of the system (e.g. satisfaction of users) and can be checked by questionnaires, while others require the use of verification techniques over formal models (e.g. reinitializability) or validation techniques over the application (e.g. requirements fit). Such properties may be specific to the application under development or generic to a class of applications, but in all cases verification and validation tools are usually required for checking them. The usability of these tools has a significant impact on the validation and verification (V&V) phases which usually remain perceived as very resource consuming. This chapter proposes a user–centred view on the use of formal methods, especially on the use of formal modelling tools during the development process of an interactive system. We propose to apply Norman’s action theory to the engineer tasks of formal modelling in order to analyse how modelling tools impact the following engineer activities: model editing, model verification and model validation. The CIRCUS Integrated Development Environment serves as an illustrative example to exemplify how engineer tasks may be impacted by modelling tools features.

International audience; Interactive cockpits have been used since the early 00's in many aircraft cockpits, but the use of interactivity still remains limited to non-critical functions even in the most recent aircrafts. Indeed, engineering such interactive systems is still a challenge and their engineering has not reach the Design Assurance Level required for critical functions. In interactive cockpits, interaction takes place through graphical input devices and keyboards (such as the Keyboard Cursor Control Unit in Airbus family) while the behavior of the User Interface (UI) must be compliant with the specifications defined in ARINC 661 standard. The tool-supported three-fold approach presented in this paper proposes means for increasing the assurance level of interactive systems. The approach includes a formal description technique for describing each component of an interactive system (detection and prevention of development faults), a command and monitoring technique dedicated to interactive systems components (detection of natural faults) and a segregation runtime environment (prevention of faults propagation) We report on the implementation of a Flight Control Unit (FCU) panel using this approach, inspired by the FCU of the A380.

In the field of critical systems, safety standards such as DO-178C define Development Assurance Levels (DALs) for software systems (or sub-systems). The higher the consequence of a failure the higher DAL is required by certification authorities. Developing a system at a DAL A requires the use of formal description techniques and is thus expensive. For lower DALs, standard software development is accepted. While operating such systems, reaching a given goal might require operators to perform tasks using sub-systems of different DALs. Operations thus take place via mixed-criticality systems developed using several different techniques. In order to guarantee the effectiveness of the developed systems, it is necessary to ensure the compatibility of the operators' tasks and the system (whatever technique has been used for its development). While DAL identification is outside the scope of the paper, this article presents a task-model based approach for addressing multiple DALs for mixed-criticality interactive software. That approach proposes a systematic process for engineering mixed-criticality interactive applications. This process is supported by a software modeling and development environment integrating both formal description techniques and standard software programming techniques. The process and the development environment are illustrated with a case study of a mixed-criticality interactive cockpit application.

Ensuring the effectiveness factor of usability consists in ensuring that the application allows users to reach their goals and perform their tasks. One of the few means for reaching this goal relies on task analysis and proving the compatibility between the interactive application and its task models. Synergistic execution enables the validation of a system against its task model by co-executing the system and the task model and comparing the behavior of the system against what is prescribed in the model. This allows a tester to explore scenarios in order to detect deviations between the two behaviors. Manual exploration of scenarios does not guarantee a good coverage of the analysis. To address this, we resort to model-based testing (MBT) techniques to automatically generate scenarios for automated synergistic execution. To achieve this, we generate, from the task model, scenarios to be co-executed over the task model and the system. During this generation step we explore the possibility of including considerations about user error in the analysis. The automation of the execution of the scenarios closes the process. We illustrate the approach with an example., José Campos acknowledges support from project "NORTE01-0145-FEDER-000016", financed by the North Portugal Regional Operational Programme (NORTE 2020), under the PORTUGAL 2020 Partnership Agreement, and through the European Regional Development Fund (ERDF)

International audience; The overall dependability of an interactive system is the one of its weakest component which is usually its user interface. The presented approach integrates techniques from the dependable computing field and elements of user-centred design to provide a wider coverage of possible faults. Risk analysis and fault tolerance techniques are used in combination with task analysis and modelling to describe and analyse the impact of system faults on human activities and the impact of human deviation or errors on system performance and overall mission performance. A technique for systematic analysis of human errors, effects and criticality is proposed (HEECA). It is inspired and adapted from the Failure Mode, Effects and Criticality Analysis (FMECA) technique. The key points of the approach are: a) the HEECA technique combining a systematic analysis of the effects of system faults and of human errors, b) a task modelling notation to describe and to assess the impact of system faults and human errors on operators’ activities and system performance. These key points are illustrated on an example extracted from a case study of the space domain. It demonstrates the feasibility of this approach as well as its benefits in terms of identifying opportunities for re-designing the system, re-designing the operations and for modifying operators’ training. Lastly, a discussion presents the main challenges for also taking into account organisational faults in an integrated way with the proposed approach.

Since the introduction of the ARINC 661 standard (that defines graphical interfaces in the cockpits) in the early 2000, modern aircrafts such as the A380, the A350 or the B787 possess interactive systems. The crew interacts, through physical devices similar to keyboard and mouse, with interactive applications displayed on screens. For dependability reasons, only non-critical avionics systems are managed using such interactive systems. However, their use brings several advantages (such as a better upgradability), leading aircraft manufacturers to generalize the use of such interactive systems to the management of critical avionics functions. To reach this goal, we propose a dual and homogeneous fault prevention and fault tolerance approach. Firstly, we propose a model-based approach to describe in a complete and unambiguous way interactive software components to prevent as much as possible development software faults. Secondly, we propose a fault tolerant approach to deal with operational natural faults and some residual software faults. This is achieved through the implementation of a fault tolerant architecture based on the principle of self-checking components. Our approach is illustrated on a real size case study: an interactive application based on the command and control system of the A380 autopilot.; Depuis l'introduction au début des années 2000 du standard ARINC 661 (définissant les interfaces graphiques dans les cockpits), les avions modernes, tels que l'A380, l'A350 ou le B787, intègrent des systèmes interactifs permettant à l'équipage d'interagir avec des applications interactives. Ces applications sont affichées sur des écrans à travers l'utilisation d'un dispositif similaire à un clavier et une souris. Pour des raisons d'exigences de sûreté de fonctionnement, l'utilisation de ces systèmes est limitée, à l'heure actuelle, à la commande et au contrôle de fonctions avioniques non critiques. Cependant, l'utilisation de ces systèmes dans les cockpits d'avions civils apporte de nombreux avantages (tels qu'une amélioration de l'évolutivité du cockpit) qui amènent les industriels à chercher comment l'étendre à la commande et le contrôle de systèmes avioniques critiques. Dans cette optique, nous proposons une approche duale et homogène de prévention et de tolérance aux fautes pour concevoir et développer des systèmes interactifs tolérants aux fautes. Celle-ci repose, dans un premier temps, sur une approche à base de modèles permettant de décrire de manière complète et non ambiguë les composants logiciels des systèmes interactifs et de prévenir les fautes logicielles de développement. Dans un second temps, elle repose sur une approche de tolérance aux fautes naturelles et certaines fautes logicielles résiduelles en opération, grâce à la mise en œuvre d'une solution architecturale fondée sur le principe des composants autotestables. Les contributions de la thèse sont illustrées sur une étude de cas de taille industrielle : une application interactive inspirée du système de commande et contrôle de l'autopilote de l'A380.

International audience; Formal methods provide support for validation and verification of interactive systems by means of complete and unambiguous description of the envisioned system. They can also be used (for instance in the requirements/needs identification phase) to define precisely what the system should do and how it should meet user needs. If the entire development process in supported by formal methods (for instance as required by DO 178C [7] and its supplement 333 [8]) then classical formal method engineers would argue that the resulting software is defect free. However, events that are beyond the envelope of the specification may occur and trigger unexpected behaviors from the formally specified system resulting in failures. Sources of such failures can be permanent or transient hardware failures, due to (when such systems are deployed in the high atmosphere e.g. aircrafts or spacecrafts) natural faults triggered by alpha-particles from radioactive contaminants in the chips or neutron from cosmic radiation. This position paper proposes a complementary view to formal approaches first by presenting an overview of causes of unexpected events on the system side as well as on the human side and then by discussing approaches that could provide support for taking into account system faults and human errors at design time.

Task models are a very powerful artefact describing users’ goals and users’ activities and contain numerous information extremely useful for designing usable interactive applications. Indeed, task models is one of the very few means for ensuring effectiveness of the application i. e. that the application allows users to reach their goals and perform their tasks. This paper presents a tool-supported framework for exploiting task models throughout the development process and even when the interactive application is deployed and used. To this end, we introduce a framework for connecting task models to an existing, executable, interactive application. The main contribution of the paper lies in the definition of a systematic correspondence between the user interface elements of the interactive application and the low level tasks in the task model. Depending on the fact that the code of the application is available or not, the fact that the application has been prepared at programming time for such integration or not, we propose different alternatives to perform such correspondence (in a toolsupported way). This task-application integration allows the exploitation of task models at run time bringing in the benefits listed above to any interactive application. The approach, the tools and the integration are presented on a case study of a Flight Control Unit (FCU) used in aircraft cockpits. This paper extends the article entitled ‘A Generic Tool-Supported Framework for Coupling Task Models and Interactive Applications’ which have been presented at the 7th ACM SIGCHI Symposium on Engineering Interactive Computing Systems (EICS 2015). In this expanded version, the detailed description of the correspondence between annotations in the program of the interactive application and interactive tasks in the task models has been added. The complete version of the case study has also been integrated so that the application of each step of the proposed validation process is presented.

International audience; The overall dependability of an interactive system is one of its weakest components, which is usually its user interface. The presented approach integrates techniques from the dependable computing field and elements of the user-centered design. Risk analysis and fault-tolerance techniques are used in combination with task analysis and modeling to describe and analyze the impact of system faults on human activities and the impact of human deviation or errors on system performance and overall mission performance. A technique for systematic analysis of human errors, effects, and criticality (HEECA) is proposed. It is inspired and adapted from the Failure Mode, Effects, and Criticality Analysis technique. The key points of the approach are: 1) the HEECA technique combining a systematic analysis of the effects of system faults and of human errors; and 2) a task modeling notation to describe and to assess the impact of system faults and human errors on operators' activities and system performance. These key points are illustrated on an example extracted from a case study of the space domain. It demonstrates the feasibility of this approach as well as its benefits in terms of identifying opportunities for redesigning the system, redesigning the operations, and for modifying operators' training.

Task models are a very powerful artefact describing users' goals and users' activity and contain numerous information extremely useful for designing usable interactive application. Indeed, task models is one of the very few means for ensuring effectiveness of the application i.e. that the application allows users to reach their goals and perform their tasks. Despite those advantages, task models are usually perceived as a very expensive artefact to build that has to be thrown away as soon as the interactive application has been designed, i.e. right after the early stages of the design process are performed. However, tasks models can also be of great help for instance when used to support training material production, for training of operators and for providing tasks and goals oriented contextual help while the interactive application is being used ... This paper proposes a tool-supported framework for exploiting task models throughout the development process and even when the interactive application is deployed and used. To this end, we introduce a framework for connecting task models to an existing, executable, interactive application. The main contribution of the paper lies in the definition of a systematic correspondence between the user interface elements of the interactive application and the low level tasks in the task model. Depending on the fact that the code of the application is available or not, the fact that the application has been prepared at programming time for such integration or not, we propose different alternatives to perform such correspondence (in a tool-supported way). This task-application integration allows the exploitation of task models at run time bringing in the benefits listed above to any interactive application. The approach, the tools and the integration are presented on a case study of a Flight Control Unit (FCU) used in aircraft cockpits.

International audience; Engineering interactive systems for safety critical applications such as in avionic digital cockpits (and more generally Graphical User interfaces) is a challenge from a dependability viewpoint. The dependability of the user interface and its related hardware and software components must be consistent with the criticality of the functions to be controlled and their required DAL levels. This paper proposes a stepwise refinement approach going from systematic identification of failure modes of these systems to their detection via formally defined assertions. The last steps of the approach present how the assertions can be included into the monitoring part of self-checking interactive components and how they can be deployed on an architecture compliant with the ARINC 653 specification, ensuring temporal and spatial segregation, thus detecting errors and preventing failures due to both physical and transient software faults. We present how these contributions have been applied to the Flight Control Unit Backup interactive application which is available in A380 interactive cockpits.

National audience; Research contributions to improve interactive systems reliability as, for now, mainly focused towards fault occurrence prevention by removing software bugs at development time. However, Interactive Systems complexity is so high that whatever efforts are deployed at development time, faults and failures occur at operation time. Root causes of such failures may be due to transient hardware faults or (when systems are used in high atmosphere) may be so called "natural faults" triggered by alpha particles in processors or neutrons from cosmic radiations. This paper proposes an exhaustive identification of faults to be handled in order to improve interactive systems reliability. As currently no research has been carried out in the field of interactive systems to detect and remove natural faults, this paper proposes a software architecture providing fault-tolerant mechanisms dedicated to interactive systems. More precisely, the paper how such architecture addresses the various component of interactive applications namely widgets, user application and window manager. These concepts are demonstrated through a case study from the domain of interactive cockpits of large civil aircrafts. \; La recherche pour améliorer la fiabilité des systèmes interactifs s’est, pour l’instant, principalement dirigée vers la prévention d’introduction de fautes par la suppression des bugs lors du développement. Cependant, la complexité des systèmes interactifs est telle que, quels que soient ces efforts, des défaillances apparaissent lors de leur utilisation. Les causes de telles défaillances peuvent être dues à des pannes matérielles intermittentes ou (quand ces systèmes sont utilisés en haute altitude (avions, véhicules spatiaux …) être déclenchées par des fautes naturelles dues aux particules alpha dans les processeurs ou aux neutrons issus des radiations cosmiques. Cet article propose l’identification exhaustive des problématiques se posant pour améliorer la fiabilité des systèmes interactifs en prenant en compte à la fois les erreurs faites dans les phases de développement et les fautes qui peuvent se produire lors de leur utilisation. Du fait qu’aucune recherche n’a été menée à ce jour pour détecter et éliminer les fautes naturelles, l’article propose aussi une architecture logicielle pour intégrer des mécanismes de tolérance aux fautes dans les systèmes interactifs. L’article présente en particulier comment cette architecture couvre les différents composants d’un système interactif incluant les widgets, le gestionnaire de fenêtres et l’application interactive. Ces concepts sont mis en œuvre sur une application interactive de cockpits d’avions civils.

International audience; Assuring that operators will be able to perform their activities even thought the interactive system exhibits failures is one of the main issues to address when designing and implementing interactive systems in safety critical contexts. The zero-defect approaches (usually based on formal approaches such as [5]) try to guarantee that the interactive system will be defect free and thus will be fully functional during operations. While this has been proved a good mean for removing faults and bugs at development time, natural faults (such as bit-flips due to radiations) are beyond their reach. To address this kind of faults three main approaches are available: include fault tolerant mechanisms such as the ones offered by self-checking user interfaces [7], reconfigure the user interface and the interaction techniques so that part of the operations can still take place [4] or duplicate interactive systems and their user interfaces so that if one system fails, operation can still take place using a redundant one. This position paper investigates this last option connecting this redundancy approach to the concept of Distributed User Interfaces that provide a generic framework for understanding both their advantages and their limitations.

International audience; A cockpit (also called flight deck) is an interactive environment of an aircraft which enables both pilot and first officer to monitor the aircraft systems and to control them. Allowing the crew to control aircraft systems through display unit by using keyboard and cursor control unit is one of the main novelties in the new generation cockpits based on ARINC 661 standard. Currently only secondary aircraft systems are managed using such interactive cockpits. Generalisation to other aircraft systems would require introducing mechanisms aiming at ensuring the fault-tolerance of such interaction in cockpits. Such mechanisms would allow designers to take into account the new functions' safety requirement. However, it is possible that such mechanisms may have consequences (positive and/or negative ones) on the crew activities. This paper reports studies that have been performed on fault-tolerance mechanisms in the domain of ARINC 661 interactive cockpits. More precisely this paper focuses on interactive systems, showing how these fault-tolerance mechanisms (mainly redundancy as segregation and diversity are not exemplified here) could affect the usability of the interactive system, making both the tasks of the crew members and their training more complex. We propose a generic approach to analyse the trade-offs between dependability and usability in a software interactive cockpit environment.

International audience; The deployment of higher interactivity in avionic digital cockpits for critical applications is a challenge today both in terms of software engineering and fault-tolerance. The dependability of the user interface and its related supporting software must be consistent with the criticality of the functions to be controlled. The approach proposed in this paper combines fault prevention and fault-tolerance techniques to address this challenge. Following the ARINC 661 standard, a model-based development of interactive objects (namely widgets and layers) aims at providing zero-defect software. Regarding remaining software faults in the underlying runtime support and also physical faults, the approach is based on fault tolerance design patterns, like self-checking components and replication techniques. The proposed solution relies on the space and time partitioning provided by the executive support following the ARINC 653 standard. Defining and designing resilient interactive cockpits is a necessity in the near future as these command and control systems provide a great opportunity to improve maintenance, evolvability and usability of avionic systems.

Most of the work done for improving interactive systems reliability is based on methods and techniques to avoid the occurrence of faults. The goal of most of such techniques is to remove software defects prior to deployment. However, it has been proved that regardless of the approaches that are setup, system crashes may still occur at runtime. One of the potential sources of such crashes is natural faults triggered by alpha-particles from radioactive contaminants in the chips or neutron from cosmic radiation. This phenomenon appears with a higher probability while flying in the high atmosphere, which is the case for aircrafts. Safety-critical systems need to cope with this type of fault to be dependable.The main goal of this PhD is to provide means and methodology to build dependable interactive systems using interactive cockpits as a case study. The work presented in this doctorial consortium paper gives an excerpt of the solution proposed to build dependable interactive systems. This approach is a two-fold solution to deal with both (i) software faults prior to operation by using zero-default development dedicated to interactive systems and (ii) natural faults by embedding fault-tolerant mechanisms in the interactive system.

International audience; In the last few years, glass cockpits are being replaced by interactive cockpits to provide a higher level of integration of both command and information display. Due to their event driven nature, interactive systems offer more display and control capabilities but they require specific error detection and fault tolerance techniques to reach a high level of dependability. This paper proposes a model-based approach for adding fault tolerance mechanisms to interactive cockpits. While several mechanisms are considered and presented, the contribution is focused on the formal description of self-checking widgets, being the basis for interactive cockpits.